Along with the progress in scaling of a semiconductor device, soft-error problems caused by environmental radiation (such as terrestrial neutrons and α-rays) are becoming obvious, in particular, on SRAM (Static Random Access Memory), logic gates, and a clock system. When neutrons reach the ground, with extraordinarily high energy, they run into nucleus constituting the device, intra-nuclear nucleons (neutrons and protons) repeat collision, and nucleons with extra-high energy are emitted outside.
When the nucleons go into the state where kinetic energy is not able to be held any more, the energy being necessary for the nucleons to emit to the outside of the nucleus, the next process is that light particles such as protons, neutrons, deuterons, and alpha particles, evaporate from residual nucleus in the excited state, and finally, the residual nucleus also hold recoil energy, resulting in that all the secondary particles jump within the device by the distances corresponding to their ranges respectively.
When α-rays generated from a radio isotope included in a semiconductor package or the like, or secondary ions holding a charge being generated as a result of nuclear reaction, pass through a depletion layer of a storage node of the SRAM in the state of “high”, the storage node collects a charge equal to or more than the charge initially generated in the depletion layer, according to a funneling mechanism where the node absorbs electrons, holes flow in the reverse direction, and then a charge collection area is expanded along the tracks of the ions. When the charge being equal to or more than a critical charge is collected, which is necessary for reversing data, the “high” state shifts to the “low” state, and an error occurs in the data being held. This is referred to as a soft-error.
DICE (Dual Inter-locked storage CELL) is known as a countermeasure against the soft-error on a flip-flop (see the Non Patent Document 1). The DICE is a tolerance gaining technique utilizing limitation of MOS structure and an intermediate output, and FIG. 10 shows a basic circuit configuration. When the node logical state is represented by (node 1, node 2, node 3, and node 4), the initial state is represented by only (1, 0, 1, 0) or (0, 1, 0, 1). If it is assumed that the node 1 becomes error (0) from the state of (1, 0, 1, 0), the node 4 is turned ON in both PMOS, and nMOS, and accordingly, the state falls into midpoint potential. Then, at the next clock input time (there are two inputs, a signal input and a feedback, and constantly either one is ON and the other is OFF), the midpoint potential serves as a gate potential of the nMOS of the node 1, but the node 1 maintains “1”, because the pMOS is kept ON. In the similar manner, even though there is an error in any of the nodes including the reverse initial state, the initial state is resumed. The process above is illustrated as the state transition diagram shown in FIG. 11.
As a countermeasure against the soft-error in an electronic system, there are known the techniques such as TMR (Triple Module Redundancy), Duplication+Comparison+checkpoint (referred to as DMR, or also referred to as Double Module Redundancy), and Replication+rollback.
In the TMR, three module systems are prepared, and the same instruction is executed in each of the three modules. The result is determined by a rule of majority using a voter and the execution from the next stage keeps on, whereby a normal processing is executed even though any soft-error occurs in one module.
In the Duplication+Comparison+checkpoint, necessary number of check points are provided within the execution flow of the instruction, and parameters required for executing the instruction at the check point are stored. The same instruction is executed in two module systems, and execution results from the both modules are compared. As a result of the comparison, if there is no agreement between two results, it is regarded as occurrence of error subsequent to the check point, and the same process is executed after returning to the check point. This allows execution of the normal processing, even when the soft-error occurs in either of the modules.
In the Replication+rollback, the same instruction is executed twice in one module, and if there is no agreement between the first execution result and the second execution result, the instruction is executed again. Accordingly, even when the soft-error occurs, it is possible to execute the normal processing.